0

We are using an encryption appliance that is capable of creating S/MIME certificates for internal users. The appliance is synchronizing with AD to get the user. When the certificate is created it will contain all users smtp mail addresses configured on Exchange for this particular user.

Later e-mail addresses do NOT appear in certificate

After the certificate is created and we add another mail address for the same user we can see that the mail address is added as a property for the user account on the appliance but the certificate is not changed. I was thinking maybe it's by design that it's not possible to modify an existing S/MIME certificate (tried to find something in RFC's but without luck).

Anyone ?

I think it's the value that is controlling it

X509v3 Subject Alternative Name: 
    email:test_new@example.de, email:testnew@example.de, 
  • What encryption appliance? Why do you care/i.e.: what breaks? What does the vendor say about this? – StackzOfZtuff Jun 23 '16 at 7:47
  • it's Symantec Encryption management Server. I care because my users they have few smtp addresses associated with their accounts e.g test_new@example.de, email:testnew@example.de if they add a third e-mail address like tnew@example.de the certificate can't be used to encrypt the traffic using the 3rd e-mail address because the X509v3 Subject Alternative Name is not getting updated. – adam86 Jun 23 '16 at 7:51
  • Also will editing the cert with openssl change it's hash? I mean would I have to prvide the public portion of the cert again to 3rd parties ? – adam86 Jun 23 '16 at 8:14
  • 1
    Changing anything in a certificate invalidates the signature on it; the whole point of a certificate is that the relier trusts it because it is signed by the (trusted) CA, and only the CA can 'change' the contents by issuing a new certificate with different contents. And yes if you want reliers to use a new cert, you have to provide the new cert to them. – dave_thompson_085 Jun 23 '16 at 11:36
1

You cannot change the certificate but you can revoke it and issue a new one; or, keep the old one and let it expire on its own while issuing a new certificate for future email messages. The issue with revoking a certificate would be errors occurring if a mail client checks for revocation. To avoid this you can just leave the early certificate as valid and issue a new one as well. Any new email messages would be signed with the new certificate containing all of the email addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.